DOCSIS 2.0 SCDMA capable sniffers which can capture legacy DOCSIS bursts as well

ABSTRACT

A DOCSIS 2.0 compatible sniffer which can receive legacy DOCSIS 1.x TDMA bursts as well as DOCSIS 2.0 SCDMA bursts. One embodiment uses two cable modems in the sniffer, one to capture downstream data bursts and the other to capture downstream messages and to recover the downstream symbol clock and generate an upstream reference clock which is phase coherent with the recovered downstream symbol clock. The reference clock is used by a cable modem termination system to capture upstream SCDMA DOCSIS 2.0 bursts. DOCSIS 1.x TDMA bursts may also be captured. Other embodiments use a DOCSIS 2.0 compatible modem in the sniffer to lock onto a downstream, register as a cable modem in the system and capture downstream messages in order to derive the correct timing to generate control signals to control burst capture circuitry in the sniffer to capture DOCSIS 1.x and 2.0 upstream bursts. The digital samples of each burst can be sent digitally to the CMTS under test after some fixed delay or can be sent to the CMTS under test as an analog RF signal in repeater embodiments. This allows the CMTS under test to be simplified by pushing the burst capture circuitry out to the optical node.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a divisional of U.S. patent application Ser. No.10/397,508, filed on Mar. 25, 2003, entitled “DOCSIS 2.0 SCDMA CapableSniffers Which Can Capture Legacy DOCSIS Bursts As Well”.

BACKGROUND OF THE INVENTION

In cable modem systems, there is a need to be able to debug by capturingmessage and burst traffic in the upstream and downstream directions. InDOCSIS systems, there is a need to be able to capture all the databursts, MAP and UCD messages, timestamp data, ranging request messages,ranging bursts, ranging response messages and all the other DOCSISmessages.

Sniffers exist in the prior art. A DOCSIS traffic sniffer manufacturedby Filtronic-Sigtek, Inc. (model number ST260B) can captures data burstsand message traffic in DOCSIS 1.0 and 1.1 systems. However, DOCSIS 2.0systems include the ability to send spread spectrum bursts, and theFiltronic sniffer cannot capture and demodulate spread spectrum burstsand time division multiplexed bursts at symbol rates faster than symbolrates of DOCSIS 1.0 and 1.1 systems. This device does not appear to becovered in any patents or published patent applications.

Conventional sniffers today are too complicated. It would beadvantageous to have a simple DOCSIS 2.0 sniffer which can use aconventional DOCSIS 2.0 cable modem that has been modified to providetiming and control signals for a burst capture circuit that capturesupstream bursts. It would also be advantageous to divert upstream burstsaway from a CMTS and capture them in such a sniffer and provide such asniffer with the capability to repeat captured bursts upstream so thatonly bursts and upstream messages are transmitted upstream and nothingelse is transmitted. This could replace the digital return prior artwhere everything going upstream including empty minislots is digitizedand sent upstream as digital samples. Both digital return systems in theprior art and a digital upstream sniffer/repeater allow the CMTS to nothave any burst acquisition circuitry and only use digital signalprocessing circuitry to process the digital samples. This simplifies theCMTS. However, a digital sniffer/repeater which transmits upstream onlybursts and messages allows greater consolidation of upstream trafficfrom different optical nodes and allows the CMTS to be used moreefficiently.

Accordingly, a need has arisen for a sniffer which can capture all typesof DOCSIS bursts including SCDMA DOCSIS 2.0 bursts in both the upstreamand downstream. There has also risen a need for a simpler DOCSIS 2.0upstream only sniffer and a simpler DOCSIS 2.0 upstream only snifferwith repeater capability.

SUMMARY OF THE INVENTION

Two different classes of sniffers are described herein. The first classuses one or more DOCSIS cable modems in the sniffer to capture DOCSIS1.0, 1.1 and 2.0 downstream bursts from the CMTS and to capturedownstream messages from the CMTS to implement the DOCSIS protocols. Thecaptured downstream messages include ranging invitations, rangingresponse messages which include time, frequency and power offsets andupstream equalization coefficients, and all the other downstream DOCSISmessages. Captured data from bursts and messages are transmitted by alocal area network or other data path to a line card which includes acomputer programmed to pass the data and messages to a personal computercoupled to the sniffer and to use data in the messages to do aself-ranging process and to control the upstream burst capture process.

The cable modem (CM) in the sniffer also recovers the downstream symbolclock and uses it to recover downstream bursts. If an upstream DOCSIS2.0 burst is to be captured, the CM in the sniffer uses the recovereddownstream clock to provide a phase coherent reference clock signal to amaster clock generator. The master clock generator smoothes out jitterin the reference clock signal and multiplies the reference clock signalso as to generate a high speed reference clock signal. This high speedreference clock signal is coupled to a linecard which includes a CMTSreceiver. The reference clock signal is used in the linecard to generatea 10.24 MHz local clock signal which is synchronized with the 10.24master clock signal in the CMTS under test which drives the mastertimestamp counter. The 10.24 MHz local clock signal on the linecard isused to drive a local timestamp counter in the linecard and this keepsthe linecard timestamp counter in synchronization with a mastertimestamp counter in the CMTS under test so that upstream minislotboundaries can be determined. The master timestamp counter counts ticksof the master clock in the CMTS under test.

An upstream minislot counter in the CMTS under test also counts the same10.24 MHz master clock signal, and functions to count off the boundariesin time of the upstream minislots. The sniffer linecard also has anupstream minislot counter which is kept synchronized to the minislotcounter in the CMTS by counting the 10.24 MHz local clock signal andusing captured DOCSIS 2.0 downstream timestamp snapshot messages toestablish the correct relationship between the sniffer local timestampcounter and a local minislot counter and frame counter.

The local timestamp counter in the linecard is kept in synchronizationwith the master timestamp counter in DOCSIS 1.x and DOCSIS 2.0 advancedTDMA burst capture mode using timestamp samples which are included incaptured downstream sync messages and captured timestamp snapshotmessages in DOCSIS 2.0 systems. The local timestamp counter counts afree running 10.24 MHz clock, and differences between the timestampcount and the timestamp samples are used to generate error signals toadjust the free running clock frequency to minimize the errors.

In SCDMA mode in DOCSIS 2.0 systems, an upstream symbol clock isgenerated from the recovered downstream clock in captured downstreambursts. The upstream symbol clock in the sniffer CM is output at areference clock output and is generated at a frequency which is M/N ofthe recovered downstream clock where the M and N factors are included incaptured downstream messages when upstream DOCSIS 2.0 SCDMA bursts areto be captured. This DOCSIS 2.0 upstream symbol clock is phase coherentto the recovered 10.24 MHz downstream symbol clock in that it is lockedinto phase coherency with the recovered downstream symbol clock. Phasecoherency means that for every M cycles of one clock, N cycles of theother clock will occur with simultaneous zero crossing at the end of theM cycle period, where M and N are both integers and both can be one.This upstream reference symbol clock is used by the sniffer linecard tocapture DOCSIS 2.0 SCDMA bursts. In DOCSIS 1.x and 2.0 advanced TDMAbursts, the above described processing by the sniffer CM does not occur,and the CMTS receiver in the sniffer recovers the upstream symbol clockfrom the preamble and the data of the captured burst and uses that torecover the data in the data portion of the burst.

The CMTS receiver in the sniffer and an RF demodulator section and afield programmable gate array which includes a programmable delayelement and an a programmable digital equalization filter, all arecontrolled by a programmed computer on a linecard in the sniffer.

The downstream messages transferred from the cable modems in the snifferinclude the UCD messages that define burst and channel parameters suchas symbol rate, frequency, modulation type, multiplexing type, etc. ofeach upstream logical channel. The downstream messages captured by thecable modems in the sniffer also include the MAP messages which definewhich upstream minislots will contain bursts from each cable modem undertest. The captured downstream messages also include ranging responsemessages, each such message including the ranging corrections sent bythe CMTS under test to a cable modem under test in response to anupstream station maintenance burst sent by the CM. The linecard capturesupstream initial and periodic station maintenance bursts from cablemodems under test and makes its own ranging correction calculations oneach such burst. The ranging corrections in each ranging responsemessage are subtracted from the ranging offset corrections (and upstreamequalization coefficients in the preferred embodiment) calculated by theCMTS in the sniffer to derive difference values for the time, phase,frequency and power offsets (and difference values for the upstreamequalization coefficients in the preferred embodiment). These differencevalues are calculated by the computer in the linecard and used togenerate control signals to make corrections to circuitry of the linecard in the RF demodulator and the FPGA delay and equalization filtercoefficients in a process called self-ranging to get the linecard intosynchronization with the upstream transmissions from a CM under testwhose burst is to be captured. The CMTS in the sniffer then uses thelocally generated upstream symbol clock, the upstream minislot countfrom its local timebase and data from captured UCD and MAP messages tocontrol the circuitry in the sniffer to capture both DOCSIS 1.x and 2.0bursts.

A second class of sniffers and sniffer/repeaters is characterized by:(1) the use of a slightly modified DOCSIS 2.0 cable modem in the snifferwhich registers with the CMTS as one of the CMs in the system so as tocapture the system timing of at least one upstream; and, (2) a burstcapture line of circuitry which tunes, filters, amplifies and digitizesupstream bursts to be captured and stores samples of each burst in abuffer. In some embodiments, the burst capture circuitry includes aprogrammable passband filter for precise passband tuning based uponsymbol rate and decimation circuitry to reduce the number of samples oflower symbol rate captured bursts.

Timing for the burst capture circuitry is supplied by the cable modem inthe sniffer which synchronizes to the upstream on which the bursts to becaptured will be transmitted and also captures the downstream UCD andMAP messages that define the timing and burst characteristics of everyburst to be captured. Since the sniffer's cable modem is locked onto thesame downstream as all the other cable modems in the system, it also hasits local upstream timestamp, minislot and frame counters synchronizedto the corresponding counters in the CMTS under test for DOCSIS 2.0SCDMA bursts. This is done by recovering the downstream symbol clock andgenerating an upstream symbol clock at a frequency which is M/N thefrequency of the recovered downstream clock and which is phase coherentwith the master 10.24 MHz master clock in the CMTS under test. Captureddownstream sync and timestamp snapshot messages are used to initializethe local timestamp counter in the CM and to establish the correctrelationship between the local timestamp counter and the local minislotand frame counters for 2.0 SCDMA burst capture.

In DOCSIS 1.x and DOCSIS 2.0 advanced TDMA burst capture mode, thetimestamp, minislot and frame counters are kept in synchronization usingthe same timestamp samples from the sync messages as in the case of allthe other cable modems in the system. Every cable modem in the systemuses the same free running upstream clock frequency to drive the localtimestamp counter in DOCSIS 1.x and DOCSIS 2.0 advanced TDMA bursttransmission mode. Every CM in the system on a given upstream in 1.xmode, including the CM under test, use the same sync messages in thelinked downstream to keep their local upstream timestamp counterssynchronized with the master timestamp counter in the CMTS. Therefore,each cable modem in the system will be using the same timestamp countercounts to determine the boundaries of the upstream minislots at thelocation of that cable modem. Therefore, the cable modem in the snifferwill be able to tell when each upstream minislot is occurring at itslocation and can use the copies of the captured downstream MAP data todetermine which minislots to enable the burst capture circuitry and canuse the pertinent UCD message data to control the burst capturecircuitry to capture the burst. In some embodiments, the symbol ratedata in the UCD message data can be used to control a digital passbandfilter in the burst capture circuitry to have the proper passbandbandwidth to tune out RF signals outside the bandwidth of the burst tobe captured.

The only modifications that need to be made to the cable modem'ssoftware in this second genus of sniffers is to use the MAP and UCD datato generate suitable control signals to control the burst capturecircuitry to capture upstream bursts at the proper times. In someembodiment, modifications must also be made to receive user inputdefining which bursts to capture. In other embodiments, no suchmodification to receive user input need be made since the sniffercaptures all upstream bursts.

In alternative embodiments within this genus, the captured bursts aretransmitted upstream from the buffer in the sniffer to a CMTS that hasno burst capture circuitry. This embodiment for a sniffer/repeater canbe advantageously used to replace the prior art digital return datapaths by capturing only the upstream bursts and digitizing them insteadof digitizing every minislot including empty one like the digital returntechnology. In this way, more efficient use of the CMTS can be made, andmore optical nodes can share one CMTS receiver. This is because only thebursts are sent upstream so the CMTS can pipeline process burst afterburst and need waste no time on processing samples of empty minislots.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a system in which a DOCSIS 2.0 sniffer withtwo internal cable modems is employed to capture both downstream trafficwhere one cable modem captures all downstream message traffic and theother cable modem captures downstream data bursts, and a linecard isused to capture upstream bursts from the CM under test.

FIG. 2 is a block diagram of an alternative embodiment of a sniffercapable of capturing both upstream and downstream bursts and using onlya single cable modem in the sniffer to capture both downstream burstsand downstream messages.

FIG. 3 is a flowchart of the process to keep any cable modem's localtimestamp counter synchronized with the master upstream timestampcounter in the CMTS.

FIG. 4 is block diagram of a sniffer using a cable modem to determinethe upstream timing and to control a burst capture circuit to captureupstream bursts of other cable modems.

FIG. 5 is block diagram of a sniffer using a cable modem to determinethe upstream timing and to control a burst capture circuit to captureupstream bursts of other cable modems and having the capability torepeat captured bursts upstream.

FIG. 6 is block diagram of an alternative embodiment of a sniffer usinga cable modem to determine the upstream timing and to control a burstcapture circuit to capture upstream bursts of other cable modems andhaving the capability to repeat captured bursts upstream.

FIG. 7 is a flowchart of the new part of the process carried out by thecable modem in the sniffer of FIG. 4.

FIG. 8 is a diagram of the prior art digital return structure from thediplexer at the optical node to the CMTS.

FIG. 9 is a block diagram of a sniffer based digital return structurefrom the diplexer at the optical node to the CMTS which captures onlythe bursts and does not sample empty minislots like the structure inFIG. 8.

FIGS. 10A, 10B, 10C and 10D are a flowchart of the process forcontrolling the sniffer of FIG. 1 or 2 to receive designated downstreamand upstream bursts on a downstream and an upstream (or logical channel)designated by a control computer.

FIGS. 11A through 11C illustrate the process the DOCSIS 2.0 upstream anddownstream sniffers of FIGS. 1 and 2 go through to establishsynchronization with a designated downstream and a designated upstream.

DETAILED DESCRIPTION

FIG. 1 is a block diagram of a system in which a DOCSIS 2.0 sniffer withtwo internal cable modems. Different parts of the sniffer are employedto capture both upstream and downstream traffic. A cable modemtermination system (CMTS) 10 is one of the units under test. Ittransmits DOCSIS 1.0, 1.1 or 2.0 data bursts and messages downstream ona downstream medium 12. The CMTS 10 also receives upstream DOCSIS 1.0,1.1 or 2.0 data bursts and messages from a cable modem 18 via upstreammedium 14. The upstream and downstream mediums are coupled by a diplexer16 to a plurality of cable modems (CM) of which CM 18 is typical.

A DOCSIS 2.0 sniffer 20 is coupled to the downstream and upstreammediums by taps 24 and 22 via splitters (not shown). The upstream tap 22is coupled to a linecard 26 which includes an RF demodulator 28, a fieldprogrammable gate array (FPGA) 30 including a programmable delay circuitand a programmable digital equalization filter and a clock managementcircuit (block 30 can be implemented as an FPGA, an ASIC or in randomlogic), a CMTS receiver 32 and a programmed computer 34. The RFdemodulator 28 can have the structure of any RF demodulator in a CMTSfront end which can be controlled by CPU 34 to tune the appropriateupstream logical channel, convert that frequency to a lower intermediate(IF) frequency, amplify the received signal by a programmable gain,filter out unwanted signals and digitize the IF signal. Several suitablestructures are disclosed in U.S. patent application Ser. No. 09/792,815filed Feb. 23, 2001, which is hereby incorporated by reference. The FPGA30 imposes a programmable delay controlled by CPU 34, and filters thesignal in a digital equalization filter which has its coefficientscontrolled by CPU 34. The CMTS 32 can be any CMTS receiver, and CPU 34can be any programmable computer which is programmed to control thelinecard in accordance with the teachings herein.

The linecard 26 can be structured as any CMTS receiver upstream linecard with some software modifications and some modifications to theFPGA. Only one channel of the conventional linecard need be used. Thosemodifications to the conventional linecard hardware and software are asfollows:

(1) receiving the TLVs (data elements) of UCD and MAP messages capturedby the cable modem 40 or 42 in the sniffer and converting them to theproper format and enabling searching MAP messages for the minislotnumbers of upstream bursts to be captured and determining the burstparameters from the UCD messages of bursts to be captured, and capturingupstream DOCSIS bursts designated by a control computer and transmittingat least the data from said captured bursts to said control computer viaa port on the sniffer—a TLV is a tuple with the first byte indicatingthe type of the data element, the second byte indicating the length, andthe third part indicating the value;

(2) in mixed mode when two or more logical channels are being receivedin the upstream direction, combining the MAP messages for each logicalchannel into one MAP message for use by a Jasper type CMTS receiver 32;

(3) differentially encoding preamble symbols of DOCSIS 1.xdifferentially encoded bursts before they are loaded into a Jasper typeCMTS receiver 32 (Jasper type CMTS receivers use a different preamblepattern than the CMs under test in differentially encoded bursts, butthis modification can be eliminated if CMTS receives that use the sametype preambles as the CMs under test for differentially encoded and nondifferentially encoded bursts);

(4) receiving the ranging corrections directed to each CM under testfrom the CMs in the sniffer and using the corrections sent to the CMunder test along with the ranging corrections calculated in the CMTSreceiver in the sniffer from captured upstream training bursts to getthe CMTS receiver in the sniffer in time synchronization with theselected upstream;

(5) sending control messages to the cable modems in the sniffer tocontrol which downstream bursts the CMs capture via the local areanetwork segment coupling the linecard to the CMs 40 and 42 or via anyother data path;

(6) performing all the other functions of the self ranging processesdescribed below in the self ranging section including power correctionsand setting of upstream equalization coefficients in the snifferequalization filter so as to correct for the possibly different positionon upstream HFC medium 14 from the CMTS 10 under test so as to enableproper reception of upstream bursts from CMs which have implementedranging corrections based upon ranging response messages sent from CMTS10 under test;

(7) interfacing via a LAN segment or any other data path with thepersonal computer 37 to send captured data and messages to it and toreceive control commands therefrom indicating what upstream anddownstream bursts to capture and/or any other control information neededto control the sniffer operations;

Any linecard with a CMTS receiver which has been modified in any way tohave at least the functionality of items 1, 4, 5, 6 and 7 above andwhich is capable of receiving at least upstream DOCSIS 2.0 bursts willbe referred to in the claims as a “sniffer upstream receiver” which isgenerally synonymous with a conventional upstream linecard modifiedaccording to the teachings herein. In the preferred embodiment, the CMTSreceiver has the flexibility to receive any of the different burst typesspecified in the DOCSIS 1.x or 2.0 specifications. There are 15different SCDMA and TDMA burst types at various symbol rates andmodulation types that are predefined in the preferred embodiment, andeach has a different IUC. Each burst has burst parameters, and thechannel upon which the burst is transmitted has channel characteristics.The burst parameters and channel characteristics for each channel andeach burst and the minislot numbers assigned to each upstream burst arecontrolled by the CMTS under test 10 and are sent downstream in UCD andMAP messages which are captured by cable modem 40 and transferred tocomputer 34. The MAP messages and burst parameters and channelcharacteristics define what type of bursts are going to be receivedduring each upstream minislot.

The transmission characteristics of each logical channel are separatedinto three portions: 1) channel parameters; 2) burst profile attributes,and 3) user unique parameters. The channel parameters include: a) thesymbol rate which can be any one of 6 different rates from 160 ksym/secto 5.12 Msym/sec in octave steps; b) the center frequency; and c) the1536-bit preamble superstring; and d) the SCDMA channel parameters.These characteristics are shared by all users on a given channel. Userunique parameters may vary from user to user even when on the samechannel and same burst type and include such things as power level. Thepower level of each CM is controlled by the CMTS so that bursts arriveat the CMTS at a nominal power level defined by the CMTS. Each CM mustgenerate each burst at the appropriate time so that the beginning of theburst arrives at the CMTS at the assigned first minislot boundaryspecified in the MAP message. The burst profile attributes, in thepreferred embodiment, include: modulation (QPSK, 64 QAM, 128 QAM etc.),differential encoding on or off; Trellis Code Modulation (TCM) encodingon or off; preamble length, preamble value offset; preamble type (QPSK 0or QPSK1), RS error correction T from 0 to 16 where 0 is no FEC bits to16 for the maximum where the number of codeword parity bytes is 2×T, RScodeword length (fixed or shortened), scrambler seed, max burst lengthin minislots, guardtime from 5 to 255 symbols for TDMA channels and 1for SCDMA channels, last codeword length, scrambler on or off, byteinterleaver depth, byte interleaver block size, SCDMA on or off, codesper subframe, and SCDMA interleaver step size. In other embodiments, anysmaller set of the above defined programmable burst parameters may beused so long as the receiver can receive both TDMA bursts and SCDMAbursts.

The burst parameters and the MAP messages and channel characteristicsare stored by the computer 34 in a burst parameter memory in CMTSreceiver 32 via data path 36 by a MAC process running in computer 34.

The RF demodulator section 28 is a conventional RF demodulator sectionwhich is controlled by computer 34 to tune to an upstream channelspecified in control signals or data on bus 36. The RF demodulator 28also: filters out unwanted signals outside the bandwidth of interest;amplifies the signal by a programmable gain amount in accordance withcontrol signals on bus 36; converts the RF signal of the band to whichthe RF demodulator is tuned to an intermediate frequency (IF) using aprogrammable frequency local oscillator signal the frequency of which iscontrolled by said computer 34 via control signals on bus 36, andconverts the IF signal to digital samples using a sample clock which hasa frequency high enough to meet the Nyquist criteria for the highestsample clock of any type burst which may be received. Any RF demodulatorcircuit, implemented in either analog or digital circuitry, which canfulfill these functions will suffice to practice the invention. All CMTSreceivers which are commercially available use RF demodulator sectionswhich perform these functions, and any one of them may be used.

One example of an RF demodulator section 28 is a programmable gainamplifier which amplifies the received radio frequency signals by aprogrammable gain amount. The output of this filter is filtered in abandpass filter having a broad passband covering the entire upstreamband of frequencies. The filtered output signal is mixed with a localoscillator signal having a programmable frequency to mix the RF signaldown to an IF frequency at the center frequency of a more narrowpassband bandpass filter with sharp rolloff skirts (typically a surfaceacoustic wave filter). The IF signal is then filtered in the narrowpassband filter having a passband bandwidth which may be programmable insome embodiments to the bandwidth of the actual burst to be receivedbased upon its symbol rate or which may be set at the bandwidth of thehighest symbol rate burst to be received. The filtered signal is thendigitized in an analog-to-digital converter which, in some embodiments,does IF sampling.

Another example of an RF demodulator section 28 is a programmable gainamplifier which amplifies the received radio frequency signal by aprogrammable gain controlled by computer 34. A bank of bandpass filters,each with a different center frequency and a bandwidth equal to thehighest symbol rate channel to be received share an input coupled to theoutput of the programmable gain amplifier. A multiplexer having oneinput coupled to the output of each bandpass filter and an outputcoupled to an analog-to-digital converter is controlled by the computer34 to pick the RF channel to be received. The A/D converter digitizesthe selected filtered signal and the digitized sample stream isduplicated and mixed digitally with two quadrature local oscillatorsignals of the same frequency but 90 degrees out of phase (or some oddharmonic of 90 degrees) and represented in digital form. The twoquadrature sample stream are then decimated and filtered in a decimationand filter circuit which decimates and passband filters with a bandwidthset according to the symbol rate of the burst to be received so thatexcess samples are removed and the passband bandwidth matches thebandwidth of the burst to be received to eliminate more noise.

Another example of an RF demodulator is a low resolution synthesizerwhich amplifies the received RF signal by a programmable gain and downconverts the RF to an IF frequency of approximately 5.12 MHz with thelocal oscillator frequency controlled by computer 34. An A/D converterthen digitizes the IF, and a numerically controlled digital synthesizerthen down converts the digital IF to an exact IF frequency of 5.12 MHz.The computer 34 controls the local oscillator frequency using thefrequency offset measurement developed during the self ranging process.

Another example of an RF demodulator is a programmable gain amplifierapplying a programmable gain controlled by computer 34 and broadbandpassband filter and analog mixer with the local oscillator frequencygenerated by the synthesizer controlled by computer 34 to generate ananalog IF signal. The analog IF signal is then filtered by a SAW filterwith a narrow passband at a center frequency of the IF and a bandwidthset to match the bandwidth of the burst to be received. Another downconverter fed by a fixed frequency local oscillator then lowers the IFfrequency further. A low phase noise bandpass filter then filters thenew IF frequency signal, and an A/D converter digitizes the result.

Function of the Sniffer CMTS Receiver

Any CMTS receiver design will suffice for CMTS receiver 32 especiallyone which supports any preamble pattern for upstream bursts. A shortsummary of the overall function of CMTS 32 is that it functions toreceive the digital samples output by FPGA 30 and process them in thesignal processing section of the CMTS receiver 32 to make measurementson training bursts and output those ranging corrections to CPU 34, andto recover the data of data bursts and upstream messages and output therecovered data, ranging and upstream messages to CPU 34 for transfer tocomputer 37.

U.S. patent application Ser. No. 09/792,815, filed Feb. 23, 2001 detailsstructures for various CMTS receiver embodiments, any one of which maybe used for the CMTS 32 in the sniffer. CMTS receivers of the typedetailed in U.S. patent application Ser. No. 09/792,815 will be referredto herein as Jasper type CMTS receives.

In one embodiment, a programmable digital filter in field programmablegate array 30 functions to add a programmable transfer function whichimposes a delay and gain offset correction to get the CMTS receiver 32in synchronization to receive upstream bursts. The amount of correctionis controlled by filter coefficients which are controlled by CPU 34. Inother embodiments, each of the time, phase, frequency and gain offsetsis corrected by a separate circuit or a rotational amplifier is used tomake gain and phase offset corrections, and a programmable delay circuitis used to make the timing offset correction and a programmable digitalequalization filter is controlled to do upstream equalization. Thedigital equalization filter in FPGA 30 is a 24-tap feedforward filterwith programmable taps in the preferred embodiment.

When the CMTS 32 in the sniffer is located at the same position as theCMTS 10 and receives training bursts from the CMs under test and makesthe same time offset measurements as the CMTS under test 10, themeasurements will be the same as those made by the CMTS under test 10 ifCMTS 10 is working properly. Generally, the CMTS 32 and the CMTS 10 haveoffset measurements and develop equalization coefficients from trainingbursts which not the same. In this case, the self-ranging processdescribed below is carried out to develop the proper corrections andequalization coefficients so as to achieve upstream synchronization (astate where upstream bursts can be successfully captured by thesniffer).

The CMTS receiver 32 transmits the captured upstream bursts to the CPU34 on data path 31 along with the ranging measurements (time, phase,amplitude, gain and frequency offsets and equalization coefficients) foreach CM under test which sent a training burst. The CMTS 32 alsoadaptively develops equalization coefficients for each CM from thepreamble and possibly data of that CM's captured training burst.

CPU 34 functions to receive these measurements, coefficients, data, andmessages and generate the proper control signals to control the system.It also transmits captured bursts and messages to computer 37, and mayalso transmit the ranging measurements made by the linecard for displayand/or analysis. The CPU 34 also receives commands from the computer 37and generates suitable control signals to control the linecard 26, cablemodems in the sniffer 40 and 42 and the clock generator 48.

Data path 38 could be an Ethernet LAN connection, a USB or SCSI port, orany other known or proprietary bus or LAN and communication/busprotocol. The PC 37 is programmed to display and/or process the captureddata, measurements, messages, coefficients, etc. and provide reports orjust display the captured items.

Linecard Timebase

The linecard 26 needs to have a timebase which will keep it synchronizedwith the system upstream of interest so that the CMTS receiver 32 in thesniffer can capture designated upstream bursts. Therefore, the CMTS 32must have a local timestamp counter which is synchronized with themaster timestamp counter in the CMTS 10 under test because the mastertimestamp counter in the CMTS 10 is used to determine the upstreamminislot boundaries for the upstream transmission grants to the CMs inthe downstream MAP messages. So the linecard in the sniffer needs tohave its local timestamp counter and minislot counter and frame counter(these three counters along with the upstream symbol clock are the mostimportant clocks in the linecard timebase) synchronized withcorresponding counters in the CMTS under test and in the cable modemunder test so that the sniffer can determine when upstream minislot inwhich bursts to be captured are occurring at the tap points of thesniffer.

The basic idea of timebase synchronization is to get the timebase in thesniffer to a condition that an upstream burst in a particular minislotor group of minislots can be captured. This requires several things ofthe timebase. First, one must know when particular minislots areoccurring at the sniffer upstream tap. Second, an upstream symbol clockin the sniffer must be in sync with the upstream symbol clock of the CMwhich transmitted the burst. In other words, when a cable modem undertest has been told to transmit an upstream burst during a particularminislot, the timestamp and minislot counters in the sniffer (which willbe coupled to the HFC upstream medium between the CM under test and theCMTS) must be in a state such that they can be used to determine whenthat particular minislot's signals are propagating past the sniffer'supstream tap point so that the upstream burst capture circuitry can beturned on to capture the burst. Then, if the upstream symbol clock inthe sniffer linecard timebase is synchronized with the upstream symbolclock in the CM which transmitted the burst, the upstream symbol clockin the sniffer can be used to successfully recover the data in theburst.

Accordingly, the downstream timestamp samples in the downstreamsynchronization (hereafter sync or synch) messages and timestampsnapshot messages need to be sent to the linecard 26 for use insynchronizing the local timestamp counter in the CMTS receiver 32 in thesniffer to the master timestamp counter in the CMTS 10 under test atleast in DOCSIS 2.0 burst capture mode, as will be described furtherbelow.

The CMTS receiver 32 in the sniffer also needs to generate a 10.24 MHzclock which is synchronized with the 10.24 MHz master clock signal usedby CMTS 10 to increment the master timestamp counter in 2.0 SCDMA burstcapture mode or which is frequency adjusted using timestamp samples in1.x and 2.0 advanced TDMA burst capture mode so that the CMTS 32 canincrement its local timestamp counter in synchronizm with theincrementation of the master timestamp counter in the CMTS 10.

In some embodiments, the A/D sampling clock in the RF section 28 alsoneeds to be synchronized with the sampling clock in the burstacquisition circuitry of the CMTS 10 under test. Therefore, the linecard26 must have a master clock synchronized with the master clock in theCMTS 10 under test at least for 2.0 SCDMA burst capture at least forthese embodiments.

Generation of a 10.24 MHz master clock for the CMTS 32 starts by usingDOCSIS 2.0 cable modem 40 to recover the downstream symbol clock. Oncethe downstream symbol clock is recovered, the CM 40 in the snifferreceives the downstream messages. These messages include: UCD, MAP,SCDMA upstream ratio numerator, SCDMA upstream ratio denominator, SCDMAtimestamp snapshot and sync messages containing timestamp samples forTDMA channels, and ranging response messages. The ranging responsemessages contain ranging corrections of power, time, phase and carrierfrequency offset and upstream equalization coefficients sent to themodems. The captured timestamp samples are sent to the linecard 26 asare the UCD and MAP messages. The ranging correction offsets and the USequalization coefficients for each particular CM are also sent to thelinecard.

The CM 40 communicates with the linecard 26 to send these capturedmessages to CPU 34 via a local area network link 82. Data path 82 isalso used to supply any control data needed by CM 40 from computer 34such as data that defines which downstream RF carrier to tune and whichdownstream bursts are to be captured.

The captured MAP, UCD and other downstream messages must reach thelinecard 26 early enough for the CPU 34 to use the data therein tocontrol the linecard's CMTS receiver 32 and other burst capturecircuitry in time to receive the designated upstream bursts from the CMunder test. In order to help with the timing, two CMs are used toreceive downstream data. CM 40 receives only downstream messages andsends them to the linecard via LAN link 82, and CM 42 captures onlydownstream data bursts and sends them to the linecard via LAN connection80.

The delay in sending the timestamp samples to the linecard from thesniffer cable modem needs to be compensated. The exact timebase offsetto use for this compensation can be found from the ranging offsetcorrections sent downstream by the CMTS 10 in response to an initialmaintenance burst IUC3 from a cable modem close to the sniffer. In SCDMAmode, the timestamp snapshot is also sent from the CM 40 to the linecard26 for use in establishing the correct relationship between the localtimestamp counter and the local minislot and frame counters.

To generate a master clock for the CMTS receiver 32 in the sniffer, theCM 40 is also used to recover the downstream symbol clock in the normalmanner and generate a phase coherent upstream clock reference to enablecapture of DOCSIS 2.0 SCDMA bursts. In DOCSIS 2.0 SCDMA bursts, theupstream reference clock must be phase coherent with the downstreamsymbol clock. In DOCSIS 2.0 cable modems, and in CM 40 in the sniffer in2.0 SCDMA burst capture mode, there is circuitry that operates torecover the downstream symbol clock and generate an upstream referenceclock from it. This upstream reference clock is output on line 44 and is2.56 MHz in the preferred embodiment, although in alternativeembodiments, a 10.24 MHz or 20.48 MHz reference clock can be output online 44 from the sniffer cable modem. In some embodiments, the CM 40also generates an upstream symbol clock in 2.0 SCDMA burst capture modewhich phase coherent with the recovered downstream symbol clock and hasa frequency at a ratio of M/N where M and N are integers included in theUCD message. In embodiments where multiple upstreams are in use, the UCDmessage pertaining to the upstream on which bursts are to be captured isused. This M/N upstream symbol clock is the clock the linecard needs tocapture 2.0 SCDMA bursts. Since this clock is generated in CM 40, itmust either be provided on a separate output line (not shown) to thelinecard, or the linecard must regenerate this clock frequency from theclock reference signal on line 46 which is also phase coherent with therecovered downstream symbol clock in 2.0 SCDMA burst capture mode. Insome embodiments, CM 40 sends samples of this clock via LAN segment 82to CPU 34 for use in keeping a PLL that regenerates the upstream symbolclock on the linecard synchronized.

Typically, a phase locked loop (PLL) is used to generate the M/Nupstream clock. This PLL locks onto the downstream clock and generatesan upstream clock which is phase locked to the downstream clock. Anexample of circuitry in a cable modem to perform this function is givenin U.S. Pat. No. 6,243,369 which is hereby incorporated by reference. Insome embodiments, a first PLL recovers and tracks the downstream clockand provides it as a reference frequency to another PLL which generatesan upstream clock at a frequency M/N times the downstream symbol clockfrequency.

In 2.0 SCDMA burst capture mode (which is the only mode where the clockreference on line 44 is generated), the upstream clock reference signalon line 44 is a 10.24 MHz clock signal divided by 4. This clockreference is output by CM 40 on line 44 at the upstream RF output (in aspecial test mode) as a 2.56 MHz reference clock signal to the clockgenerator 48. The 2.56 MHz reference signal on line 44 is phase coherentwith the recovered downstream symbol clock, and is actually alternatingones and zeros at 5.12 MHz. In some embodiments, it is taken from theupstream input to the tuner of CM 40, and the upstream input to thetuner in CM 40 is disconnected. This is the main clock reference signaland is selected by multiplexer 50 most of the time. The other clockreference signals that can be selected for use by the clock generator 48are mainly for test purposes. In some embodiments, the clock referenceon line 44 derived by the cable modem is the only clock reference signalfor the PLL 58 and even this signal is not required if only 1.x or 2.0advanced TDMA bursts are the only bursts to be sniffed. In the preferredembodiment, the PLL 58 has its reference clock input coupled through amultiplexer to either the 2.56 MHz reference clock on line 44 or a 10.24MHz reference clock on line 52 from an external sources such as a CMTSunder test.

Any clock generator 48 which receives at least the recovered downstreamclock reference signal on line 44 and which smoothes it out using a PLLor using any other means to remove or reduce the jitter and generates anupstream clock reference signal on line 46 will suffice the practice theinvention and will be referred to in the claims as a “sniffer clockgenerator”.

For TDMA bursts, DOCSIS 2.0, 1.1 and 1.0 cable modems, and CM 40 inparticular, have a free running 10.24 MHz upstream clock which iscounted by a local timestamp counter in the CM. Each cable modemshowever must keep its local timestamp counter synchronized with a masterupstream timestamp counter in the CMTS which is counting the masterclock because the local timestamp counter and local minislot counterwhich are both counting the same master clock, are used to determinewhen the upstream minislots assigned to each CM are occurring. To keepthe CM timestamp, minislot and frame counters in sync with the CMTScorresponding counters in 1.x and 2.0 advanced TDMA burst capture mode,the CMTS periodically sends timestamp counter samples downstream in syncand timestamp snapshot messages. The timestamp snapshot messages containsamples of the CMTS master upstream timestamp and minislot and framecounters taken at the time of the message. The CMs receive thesetimestamp sample messages in TDMA mode, and use the timestamp samples inthem to make corrections to their local timestamp and minislot countersas will be detailed below. This process of maintaining synchronizationof the local upstream timestamp counter in each CM in the system usingthe sync messages is illustrated in the flowchart of FIG. 3. A morecomprehensive process flow which includes an alternative embodiment ofthe process of FIG. 3 is given for DOCSIS 2.0 SCDMA burst capture andDOCSIS 1.x and 2.0 advanced TDMA burst capture mode in FIGS. 10 and 11,respectively (each of which is comprised of multiple sheets).

The CM 40 in the sniffer also performs this process, but it is notnecessary since neither CM 40 or CM 42 will send any upstream bursts soknowledge by these CMs of the upstream minislot boundaries is notnecessary in some embodiments. However, the CMTS receiver 32 in thesniffer does need to know the upstream minislot boundaries so that itcan use the MAP and UCD data to capture upstream bursts from the CMunder test. Accordingly, CM 40, which recovers the timestamp samplesfrom the CMTS under test along with all the other downstream messagessuch as ranging corrections, MAP messages and UCD messages, sends thesetimestamp samples and all the other captured downstream messages to thesniffer linecard. The linecard in the sniffer uses the timestamp samplesreceived from CM 40 to make initial settings and corrections in anupstream timestamp, minislot and frame counters, depending upon themode.

Each upstream minislot has a number and its boundaries in time aredefined by the master timestamp counter in the CMTS under test. Therewill always be an offset at any instant of time between the timestampcounter in the CMTS 32 and the timestamp counter in the CMTS 10. Thisoffset is caused by the propagation time of the timestamp samplemessages sent downstream. Even if the local timestamp counter in thesniffer is set to the timestamp count in the first timestamp samplereceived after power up and counts a clock at the same frequency as themaster clock, that timestamp sample would have been take some timeearlier, so the actual timestamp count of the master timestamp counterwill be ahead of the local timestamp counter in the sniffer. This offsetshould be constant however, and any difference is corrected by using thetimestamp samples and ranging corrections to correct the count of thelocal timestamp counter or to change the local 10.24 MHz clock frequencyso as to maintain a constant offset which is set to achieve preciseminislot boundary and frame synchronization.

This tracking and constant offset between the local timestamp counter inCMTS 32 and the master timestamp counter will be referred to in theclaims as either synchronization or “tracking the changes” of the mastertimestamp counter. This tracking of changes and correction usingtimestamp samples in downstream sync messages is done in DOCSIS 1.x andDOCSIS 2.0 advanced TDMA burst capture mode only. In DOCSIS 2.0 burstcapture mode, the 10.24 MHz clock in the linecard is not free running asit is in DOCSIS 1.x or 2.0 advanced TDMA burst capture mode. Instead, itis locked to the 10.24 MHz master clock in the CMTS by virtue of itbeing generated from the 20.48 MHz reference clock on line 46 which islocked into phase coherency with the downstream symbol clock recoveredby CM 40. The downstream symbol clock is itself locked into phasecoherency with the 10.24 MHz master clock in the CMTS under test, sothere should never be any drift between the local timestamp counter inthe sniffer and the upstream timestamp counter in the CMTS under test.

Since the recovered symbol clock in SCDMA mode is more accurate, thesniffer CM should be set in the SCDMA mode when the CMTS under test isin SCDMA or mixed mode with a first SCMDA logical channel which is timedivision multiplexed with one or more other logical channels carryingother types of bursts such as TDMA or SCDMA at a different symbol ratethan the symbol rate of the SCDMA burst in the first logical channel.

To receive 2.0 SCMDA bursts, the CMTS 10 and the CMTS 32 each use theirown upstream phase locked symbol clocks to receive the bursts becausethe upstream symbol clock in the CM that sends each SCDMA burst islocked to or phase coherent with the downstream symbol clock generatedby the CMTS as is the upstream symbol clock in the CMTS 10. The CMTSupstream symbol clock is generated from its master clock in both CMTS 32and CMTS 10.

In 1.x and 2.0 ATDMA mode, each CM under test and the CMTS 32 in thesniffer has a free running clock which is counted by its timestampcounter. The process to keep the local timestamp counter synchronizedwith the master timestamp counter in 1.x and 2.0 ATDMA burst modecapture in the CMTS 32 and the CM 40 in the sniffer and in every otherCM in the system is illustrated in the flowchart of FIG. 3.

The first step in getting each cable modem's local upstream timestampcounter in synchronization with the master upstream timestamp counter inthe CMTS 10 is symbolized by block 68 in FIG. 3. There, the firsttimestamp received from CMTS 10 after a CM powers up is set into thecable modem's local timestamp counter (this assumes the CM has alreadyrecovered the downstream symbol clock and is receiving downstreammessages).

In step 70, the local free running 10.24 MHz clock is counted by thelocal timestamp counter in the CM. Since the master upstream timestampcounter in the CMTS is also counting a master 10.24 MHz clock, thecounts at the CMTS and the CMs should remain relatively close exceptthere will be a fixed offset caused by propagation delay and some driftcaused by frequency drift of the clocks. In step 72, another timestampsample of the count in the upstream master timestamp counter at the CMTSis received in a sync message. The newly received timestamp sample iscompared in step 74 to the local timestamp counter in the CM in step 74.Step 76 represents the branch condition on the comparison. If there is adifference, step 78 is performed to reduce or eliminate the difference.IN the case of a CMTS, the error can be eliminated by setting thetimestamp received from the CMTS under test into the local timestampcounter in the timebase of the sniffer. If there is no difference,processing returns to step 70. In some embodiments of this process,instead of using the difference to correct the actual count, thedifference is used to generate an error signal to change the frequencyof the clock that drives the local timestamp counter.

The master clock in the CMTS 32 is generated from, or, in someembodiments is, a 20.48 MHz clock on line 46 generated by a clockgenerator 48. Any clock generator structure which can generate a 20.48MHz reference clock on line 46 which is phase coherent with therecovered downstream symbol clock in DOCSIS 2.0 SCDMA burst capture modewill suffice to practice the invention. In the preferred embodiment, thereference clock on line 44 is supplied as one input to a multiplexer 50,and a 10.24 MHz reference clock from a CMTS under test is supplied tothe other input of multiplexer 50. PC 37 is programmed to allow a userto select the desired reference clock input as between the signals onlines 52 and 44, and generates a clock select signal on line 54 eitherdirectly or indirectly through a command sent to CPU 34 over the datapath 38. The clock signal on line 52 is the 10.24 MHz master clock ofthe CMTS 10 under test. The clock signal on line 64 is the 20.48 MHzclock available from CMTS receivers manufactured by TerayonCommunication Systems, Inc. of Santa Clara, Calif. The clock signalselected by multiplexer 62 is controlled by a signal on line 35 fromcomputer 34, and is output on line 56 to serve as a reference clockinput to a PLL 58. The PLL 58 is controlled by the PC 37 though commandssent on data path 38 to CPU 34 to multiply the reference clock signal bya factor of 2 or a factor of 4, and output a 20.48 MHz reference clocksignal on line 60. The PLL 58 also acts as a sort of filter on thereference clock signal from the CM 40 to clean up its waveform. The PLL58 should have a bandwidth which is narrow enough to make sure the phasenoise is small. In TDMA mode, the clock signal output by the CM 40 canbe jittery because it is controlled by the received timestamps. In SCDMAmode, the upstream reference clock on line 44 is much cleaner becausethe CM 40 uses an internal PLL to generate it from the recovereddownstream symbol clock.

The reference clock signal on line 60 is coupled to one input of amultiplexer 62. The other two inputs to the multiplexer are a 20.48 MHzreference clock output on line 64 from a CMTS under test or an internal20.48 MHz reference clock on line 66 generated by linecard 26. The otherclock inputs on lines 52, 64 and 66 are for testing and greater utilitypurposes, and may be eliminated in some embodiments.

Any phase differences between the master upstream symbol clock of CMTS10 and the upstream symbol clock of the CMs under test 18 is correctedout in a timing recovery loop in the CMTS 10. There are two processesthat go on in the CMTS 10 to receive upstream bursts and in CMTS 32 tocapture upstream bursts. The first is recovery of the upstream symbolclock in 1.x and 2.0 advanced TDMA bursts. The second process involvesrecovery of the QAM symbols themselves where phase, amplitude, timingand frequency offsets are measured during the processing of a rangingburst transmitted upstream by a particular CM and the measured offsetsare sent back to this CM to make corrections in its transmitter.

This rotational amplifier uses known preamble data prepended to eachburst to develop phase and amplitude correction factors which are usedto remove phase and amplitude errors in the data portions of the burst.

The CMTS receiver 32 in the sniffer 20 also has a timing recovery looplike CMTS 10. CMTS 32 generates phase error correction factors from thepreambles and data symbols of training bursts its captures from any ofthe cable modems 18 which are used to correct phase errors in the datasymbols of data bursts. In the preferred embodiment, the CMTS receiver32, like CMTS 10, has a preamble processor which processes the knownpreamble symbols of each burst to generate initial phase and frequencyoffset correction factors. These offset correction factors are thenprovided to a timing recovery loop which uses them as a starting pointto again process the symbols of the preamble to develop fined tunedphase and frequency correction factors and then uses these correctionfactors to correct phase and frequency offsets in the data symbols ofthe burst. However, any DOCSIS 2.0 compatible receiver structure willsuffice for circuit 32.

The personal computer 37 has any user interface suitable to control thesniffer, and is programmed to receiver user commands indicating whichchannels on the upstream and downstream to monitor and capture burstsand message traffic. In particular, the user picks the upstream channelID. When the captured bursts and/or message traffic is transferred tothe CPU 34 from the CMTS receiver 32 or the cable modem 40 (whichreceives downstream bursts and messages from the CMTS 10), the PC 37 canthen display the data of the captured bursts or messages for analysis ona display (not shown). The personal computer is programmed with anyprogram that allows the user to specify which upstream and downstreamlogical channels to monitor, which bursts and/or messages to capture andwhich data and/or messages received from the sniffer to process anddisplay.

Downstream Sniffing

In the preferred embodiment, shown in FIG. 1, the sniffer 20 uses twocable modems 40 and 42 to sniff the downstream. CM 40 captures onlydownstream DOCSIS messages such as ranging invitations, MAP messages,UCD messages, ranging response messages and all the other DOCSIS 2.0downstream messages. CM 42 captures only the downstream data bursts. Alocal area network or other data path 80 couples this CM to the CPU 34so that recovered downstream data and other things may be sent to theCPU 34 and transferred to the PC 37, and so that any control data neededby the CM can be supplied by computer 34 such as control data thatdefines which downstream RF carrier to tune and which downstream burstsare to be captured.

The division of labor between CMs 40 and 42 improves the performance ofthe system since there may be hundreds of cable modems such as CM 18coupled to the same CMTS 10. In alternative embodiments such as is shownin FIG. 2, only a single cable modem 40 is used to capture alldownstream data bursts and message traffic for all cable modems such as18. The cable modems 40 and 42 can be any DOCSIS cable modem structurewhich is capable of receiving DOCSIS 2.0 bursts and message trafficwhich are modified in accordance with the teachings herein. In thepreferred embodiment, both cable modems 40 and 42 can also receiveDOCSIS 1.1 and DOCSIS 1.0 bursts and message traffic.

The cable modem 40 and the CMTS receiver 32 must each be capable ofreceiving at least DOCSIS 2.0 bursts and messages regardless of the typeof multiplexing, symbol rate, channel frequency, modulation type and allthe other programmable parameters of DOCSIS 2.0 systems.

The cable modems 40 and 42 are conventional except that a few softwarechanges are necessary for the sniffer function. These modifications are:

(1) collecting downstream bursts addressed to other cable modems, andpacketizing them into a LAN packet addressed to CPU 34 or otherwisetransferring them to CPU 34 by any other data path;

(2) sending the captured downstream bursts and the TLVs (data elements)of the UCD and MAP messages to the linecard 26 by packetizing them intoa LAN packet addressed to CPU 34 or otherwise transferring them to CPU34 by any other data path;

(3) capturing and sending the ranging corrections from ranging responsemessages addressed to cable modems under test to the linecard 26 bypacketizing them into a LAN packet addressed to CPU 34 or otherwisetransferring them to CPU 34 by any other data path;

(4) receiving and implementing control messages from the linecard CPU 34such as messages specifying SIDs of particular CMs under test for whichthe cable modems of the sniffer are to capture the downstream databursts and messages directed thereto by the CMTS under test; and

(5) enabling a debug mode and a mode to capture upstream SCDMA burstswherein a 2.56 MHz reference clock generated from the recovereddownstream clock in SCMDA mode at least is output at upstream RF output44 for use by the linecard 26 for generating an upstream symbol clockwhich is phase coherent with the recovered downstream clock. Generationof this reference clock from the sniffer cable modem which is phasecoherent with the recovered downstream clock is only necessary whereupstream DOCSIS 2.0 SCDMA bursts are to be captured or in debug mode,and, in alternative embodiments, the reference clock generated is 10.24MHz or some harmonic thereof, but in all cases where SCDMA bursts are tobe captured, the reference clock must be phase coherent with thecaptured downstream clock. Generation in the sniffer of an upstreamsymbol clock is not necessary to the invention if TDMA or DOCSIS 2.0advanced TDMA bursts are the only bursts to be captured.

Any DOCSIS 2.0 compatible cable modem which has been modified to havethe functionality of at least elements 1, 2, 3, 4 and 5 above willsuffice to practice the invention to capture DOCSIS 2.0 SCDMA bursts,and will be referred to in the claims as a “sniffer cable modem”.However, the term “sniffer cable modem” should also be interpreted tonot require generation in the sniffer of an upstream symbol clock whichis phase coherent with the recovered downstream clock where TDMA orDOCSIS 2.0 advanced TDMA bursts are the only types of bursts to becaptured.

Self Ranging

The CMTS receiver 32 receives both timestamps and timestamp snapshotmessages from the CM 40 in the sniffer which receives downstreammessages in 2.0 SCDMA mode. The CM 40 can send these messages to CPU 34via a local area network link 82 or other data path which couples the CM40 to the CPU 34. The sniffer linecard 26 receives the upstream trainingbursts from the CM 18 under test just like the CMTS 10 under testreceives them. The training burst is processed in CMTS 32 just like itis processed in CMTS under test 10 to make time, frequency, phase andgain offset measurements and to develop upstream equalizationcoefficients from the known preamble data in the training burst.However, the CMTS 32 is often not located at the same position in thesystem as the CMTS 10, so these offset measurements and equalizationcoefficients developed in CMTS 32 will not be the same as are developedin CMTS 10.

Because the CMTS 32 in the sniffer is at a different location than theCMTS under test (sometimes), the time, frequency, phase and amplitudeoffset corrections and the equalization coefficients developed by CMTS32 are not sent to the CM under test 18. To do so would interfere withthe actual time, frequency, phase and amplitude offset corrections andthe equalization coefficients sent to the CM 18 by the CMTS 10 undertest and developed from CM 18's upstream ranging burst by CMTS 10.Instead, the time, frequency, phase and amplitude offset corrections andthe equalization coefficients developed by CMTS 32 from a capturedtraining burst from a CM under test 18, after transfer to the CPU 34,are modified and then used to adjust certain circuits in the sniffer.This is done to achieve proper synchronization with CM 18 whose upstreambursts are to be captured. The same process happens in CMTS 32 for everyother CM in the system. More specifically, the adjustment of thesniffer's circuitry to achieve self-ranging is done using the rangingcorrections developed by CMTS 32 from a particular CM's upstreamtraining burst after subtracting the ranging corrections sent downstreamto that CM by the CMTS 10. The modified time, phase, frequency,amplitude offsets and upstream equalization coefficients are used to setthe coefficients of the programmable digital upstream equalizationfilter in FPGA 30, the delay of a programmable delay circuit in FPGA 30,the coefficients of a rotational amplifier in the CMTS 32 and the gainof an amplifier, and the frequency offset in the RF demodulator section28. CPU 34 makes the subtraction or other processing necessary to getthe right frequency, phase, gain and timing offsets for use in thesniffer. The results are loaded into the appropriate circuits on thelinecard 26 to get it into a state where it can receive upstream burstsfrom a particular CM under test.

Thus, for example, the results of a subtraction of the upstreamequalization coefficients sent by CMTS 10 from the upstream equalizationcoefficients developed by CMTS 32 are loaded as the filter coefficientsof the programmable equalization filter in FPGA 30. The result of asubtraction of the gain adjustments developed by the CMTS 10 and theCMTS 32 is used to adjust the gain of a programmable gain amplifier inRF section 28 via control signals on bus 36. The frequency offsetdeveloped by CMTS 10 from the training burst sent by CM 18 is subtractedfrom the frequency offset developed by CMTS 32, and the result is usedto adjust a local oscillator signal feeding a mixer in RF demodulator 28to achieve the proper IF frequency. A subtraction of the time offsetdeveloped by the CMTS 10 from the time offset developed by CMTS 32 fromthe same training burst from a particular CM is used to set the amountof a programmable delay imposed by a programmable delay circuit in FPGA30. This allows the sniffer to achieve proper timing, phase, frequencyand amplitude alignment and proper upstream equalization to receiveupstream bursts from a particular CM transmitting on a particularupstream.

In some embodiments, the ranging corrections developed by CMTS 32 willbe transferred to the CPU 34 for transfer to the computer 37 and thecaptured downstream ranging corrections from the CMTS 10 will be sentfrom CM 40 to CPU 34 and from there to computer 37 for comparison withthe ranging corrections determined by CMTS 32 to see if they are thesame. This comparison is only meaningful as a test on the rangingcorrection functionality of CMTS 10 if the sniffer 20 is located at thesame location on the HFC upstream medium 14 as the CMTS 10.

Note that if the self-ranging corrections are done while a burst isbeing received by the CM 40 or 42, the burst may be corrupted.Therefore, the corrections should be done only when they are big enough.Also, in the preferred embodiment, the corrections are scheduled when nobursts are scheduled to be received, a fact which is known from thedownstream MAP messages captured by the CM 40. The trigger signalgenerated by CMTS receiver 32 can be used to schedule the corrections.

The frequency correction offset is made in the RF demodulator circuit 28using the difference by subtracting from the frequency offset correctiondeveloped by the CMTS receiver 32 from the captured training burst fromCM 18 the frequency offset correction developed by the CMTS under test10 from the same training burst from CM 18. The difference is used toadjust the local oscillator frequency in the RF demodulator circuit 28to a frequency necessary for the upstream channel being tuned to developthe correct intermediate frequency.

Power corrections based upon the power offset measurement made by CMTSreceiver 32 less the gain corrections made by CMTS 10 from the sametraining burst are made in the RF demodulator circuit 28 based upon thecalibration of the RF gain. The RF gain is adjusted according to thegain difference between the gain offset calculated by the sniffer CMTS32 and the gain offset calculated by the CMTS 10 under test. Gaincorrection resolution is ¼ dB. The gain corrections at the linecard RFdemodulator circuit 28 use a calibration table which provides atranslation between the gain control number sent by the sniffer CPU tocontrol the gain of a programmable gain amplifier in the RF demodulatorcircuit 28 and the resulting attenuation in the RF signal that results.

Small time offset corrections in response to time offset measurementsmade by the CMTS receiver 32 are made in the sniffer by adjusting timedelay in a programmable delay circuit in FPGA 30. If larger time offsetcorrections are needed, the timestamp counter in the cable modems 40 and42 and the CMTS receiver 32 need to be adjusted. The first step inmaking corrections in the sniffer based upon time offset corrections isto set the timestamp counter in the CM 40 and 42 (for just 40 or just42, depending upon the embodiment) to the value of captured timestamp.The next step is to correct the sniffer CMTS 32 timestamp counter to anew value based upon the time offset correction developed by CMTS 32 inthe sniffer from the captured upstream training burst from CM 18 minusthe time offset correction developed by CMTS under test 10 from the sametraining burst.

The programmable equalizer filter in FPGA 30 obtains new filter taps byconvolving the current equalizer filter taps with the new correction tapcoefficients after self ranging. The new correction tap coefficients arethe equalizer tap weights developed during a tap weight adaptationprocess carried out by the CMTS receiver 32 on the known preamblesymbols of a training burst from a CM under test. The results of theconvolution have subtracted therefrom the tap weights of the equalizertap corrections developed by the CMTS 10 under test during processing ofthe preamble of the training burst received from a CM and sentdownstream to the CM under test in a ranging response message. Equalizertap weights for the equalizer filter in FPGA 30 are developed in thisway for every CM under test. To simplify the implementation, theequalizer filter in FPGA 30 can be updated only when the equalizercorrections are big enough.

Since the signal received by the FPGA 30 is centered at an IF frequencyof 5.12 MHz, the signal should be first down converted to baseband, andafter the equalizer filter, the signal should be up converted back tothe IF frequency of 5.12 MHz.

The local oscillator whose signal is used to mix the received signaldown to baseband is:LO=cos(2*π*5.12 MHz*t)−j*sin(2*π*5.12 MHz*t)  (1)Since the time t is samples at 20.48 MHz=4*5.12 MHz, the down conversionlocal oscillator is a simple signal comprised by +1, −1 and zeros:LO=(1,0,−1,0,1,0,−1,0 . . . )−j(0,1,0,−1,0,1,0,−1 . . . )  (2)The up conversion local oscillator that is used after the equalizerfilter to upconvert the signal back to IF is similar to the downconversion local oscillator except a positive sign exists before theimaginary component beginning with j in the complex number.Sniffer Timebase Synchronization Processes

The way that the cable modems under test get their timebases insynchronization is as follows.

DOCSIS 1.x and 2.0 Advanced TDMA and DOCSIS 2.0 Timebase Synch in CM'sUnder Test

The timebase of the cable modems under test are synchronized accordingto the normal operations of cable modems in the system.

DOCSIS 2.0 Sniffer Timebase Synchronization Process

The process the sniffer 20 goes through to get into synchronization withthe upstream and downstream is illustrated in the flowchart of FIGS. 10Athrough 10D. The process of FIGS. 10A through 10D essentially boils downinto four basic steps: (1) recovering a downstream symbol clock so as toenable capture of downstream messages by the sniffer, and generating alocal upstream reference clock in the sniffer from the recovereddownstream clock which is phase coherent with and locked to therecovered downstream clock; (2) using the local upstream reference clockto synchronize a timebase in the sniffer with the timebase including alocal upstream minislot counter; (3) performing a self ranging step tomake adjustments in circuits in the sniffer to synchronize it with anupstream upon which bursts to be captured are to be transmitted; and (4)using the upstream minislot counter and data in captured downstreammessages to capture upstream bursts including SCDMA bursts transmittedfrom a cable modem under test.

In step 178, the sniffer of FIG. 1 or FIG. 2 receives a command from thecomputer 37 indicating which DOCSIS 2.0 downstream to which the snifferis to monitor. This is the preferred embodiment where there may bemultiple DOCSIS downstreams sharing one upstream and/or multiple DOCSISupstreams sharing a DOCSIS downstream, and there may be multiple logicalchannels on each DOCSIS upstream and there may be flexible mappingbetween the groupings of downstreams and corresponding upstreams so thatmore upstream or downstream capacity can be added as warranted bytraffic conditions.

In step 180, the cable modem in the sniffer recovers the downstreamclock of the designated DOCSIS 2.0 downstream from step 178, and usesthat recovered downstream clock to recover downstream messages andbursts. In some embodiments, all downstream messages and bursts directedto all CMs are captured, and, in other embodiments, only messages andbursts directed to particular CMs designated by computer 37 or pertinentto particular upstreams designated by computer 37 and linked to thedownstream designated in step 178 are captured. The CM, (CM 40 in thecase of the embodiment of FIG. 1) then generates a reference clock fromthe recovered downstream clock which is locked to or phase coherent withthe recovered downstream clock. In the preferred embodiment, thereference clock is a 2.56 MHz clock, but in other embodiments, thereference clock generated from the recovered downstream symbol clock canbe a 10.24 MHz clock or a 10.24/N MHz clock where N is any integer. Thisstep is performed for DOCSIS 2.0 SCDMA upstream burst recovery only andthe reference clock must be phase coherent with the recovered downstreamsymbol clock. Phase coherent means that for every X cycles of thedownstream clock, where X is an integer, there will be Y cycles of thedownstream clock where Y is an integer an the zero crossings at the endof X and Y cycles of the two clocks, respectively, will be simultaneous.

In step 182, the sniffer receives commands from computer 37 indicatingwhich upstream or logical channel(s) linked to the downstream designatedin step 178 to which the sniffer linecard should synchronize, and whichbursts on the designated upstream or logical channel(s) (designated bySID, IP address, minislot number, etc.) which are to be captured.

In step 184, the CM in the sniffer captures the UCD and MAP messages forall the upstreams or logical channels, or at least captures the UCD andMAP messages for the upstream or logical channel designated in step 182.The captured UCD and MAP messages, or at least the TLV data itemstherefrom are sent to the linecard.

In step 186, the CM in the sniffer captures the downstream sync messagesof the designated downstream which corresponds to the designatedupstream, and captures all the timestamp snapshot messages in thedesignated downstream for all the upstreams or logical channels thatshare the designated downstream, or at least for the upstream or logicalchannel designated in step 182.

In step 188, a phase lock loop oscillator in the sniffer multiplies thereference clock signal generated by the CM in the sniffer, if needed, bya suitable factor so as to generate a reference clock for the linecardwhich is phase coherent with the downstream symbol clock. This upstreamreference clock generated by the PLL has to be fast enough to allowgeneration of a chip clock which is synchronized with the chip clock ofthe CM that sent an SCMDA burst so that the chip clock can be used indemultiplexing upstream SCDMA bursts in the CMTS receiver 32. In thepreferred embodiment, the reference clock generated by CM 40 is 2.56 MHzand it multiplied by a factor of four in the PLL to generate a 20.48 MHzreference clock for the linecard. In other embodiments, the referenceclock for the linecard can be 10.24 MHz. The frequency is not importantother than to comply with DOCSIS specifications. In general, outside ofDOCSIS, the only requirement is that the reference clock for thelinecard be phase coherent with the downstream symbol clock and theupstream symbol clock used by the CMs and with the upstream symbol clockused by the CMTS.

In step 190, if necessary, the linecard uses the 20.48 MHz referenceclock (which is phase coherent with the recovered downstream symbolclock) to generate a 10.24 MHz local clock which is locked to therecovered downstream symbol clock and which is synchronized (except fora phase difference caused by propagation delays) with the 10.24 MHzmaster clock in the CMTS 10 which is driving the master timestampcounter.

In step 192, the linecard sets the initial value of its local timestampcounter to the timesample sample number received in the first downstreamsync message for the designated upstream captured by CM 40 after thesniffer powered up. Different upstreams tied to the same downstream inDOCSIS 2.0 can have different minislot sizes so they will have separatetimestamp snapshot messages and they also have different sync messages,one for each upstream. But the master timestamp counter from which thedownstream timestamp samples are taken and master 10.24 MHz clock areshared by all upstreams. Thereafter, the local timestamp counter isdriven by the local 10.24 clock which has been slaved to the master10.24 MHz clock shared by all upstreams. This is by virtue of thedownstream symbol clock being slaved to the 10.24 MHz master clock inthe CMTS and the slaving (locked into phase coherency) of the referenceclocks generated in the sniffer to the recovered downstream symbolclock. The local timestamp counter should then track the changes in themaster timestamp counter in the CMTS without drift with some offsetbecause of the propagation delay. In some embodiments, no drift isassumed. In the preferred embodiment, the timestamp counts in subsequentsync messages are compared to the local timestamp count. If the localtimestamp counter is off by more than some programmable values, such asone count, from the timestamp sample in subsequent sync messages, thelocal timestamp counter is set to the value in the sync message. Thisoffset is set by the self-ranging process in the sniffer to achieveminislot and frame synchronization with the upstream or logical channelupon which bursts to be captured are transmitted.

In step 194, the linecard CPU searches the UCD messages received fromthe CM pertaining to the designated upstream and retrieves the M and Nvalues from the UCD message that corresponds to the upstream or logicalchannel which will carry bursts to be captured. These M and N values andthe recovered downstream symbol clock are used to generate an upstreamsymbol clock for DOCSIS 2.0 bursts to be used in the sniffer CMTS torecover 2.0 upstream bursts by multiplying the ratio M/N times the 10.24MHz reference clock in the sniffer in an M/N PLL. This synchronizes theupstream symbol clock in the sniffer with the upstream symbol clock inthe CM under test for the designated upstream or logical channel.

In step 196, the data in the captured timestamp snapshot messagepertinent to the designated upstream channel is used to set the correctvalues into the linecard's local upstream minislot and frame counters.If the sniffer has one set of minislot and frame counters for eachpossible upstream it monitors, the minislot and frame countercorresponding to the designated upstream are set to correct values usingthe pertinent timestamp snapshot message.

In step 198, the linecard in the sniffer captures an initial stationmaintenance burst from the CM under test. This training burst continueson the HFC system to the CMTS 10 under test after capture by thesniffer. The CMTS 32 in the sniffer then makes time, phase, frequencyand power offset measurements on the preamble of known symbols of thecaptured initial station maintenance burst. The CMTS 32 also developsupstream equalization filter coefficients using the preamble of thecaptured training burst. All these offset measurements and theequalization coefficients are sent to the CPU of the linecard.

In step 200, the CM in the sniffer captures a downstream rangingresponse message from the CMTS 10 under test which is sent in responseto the initial training burst. That ranging response message is sent tothe CPU of the linecard.

In step 202, the linecard CPU takes the time offset measurement of theranging response message and subtracts if from the time offsetcalculated by the CMTS 32 in the sniffer. The result is sent as acommand to a variable delay circuit in the FPGA in the linecard and isused to advance the count of the local timestamp counter by enough toestablish upstream frame and minislot synchronization for the designatedupstream and/or logical channel.

In step 204, the linecard CPU uses the rest of the measurements (phase,frequency and power offsets and equalization coefficients) made on thetraining burst from the CM under test and the ranging corrections fromthe ranging response message sent by the CMTS under test to sendappropriate power, phase and frequency, and upstream equalization filtercoefficient adjustment commands to the RF demodulator circuit 28 andequalization filter in the FPGA 30 of the linecard so as to complete theprocess of upstream synchronization. Subsequent periodic stationmaintenance bursts are captured and measurements made and the rangingresponse downstream messages are captured. The CPU repeats the selfranging process using these subsequent measurements to keep the snifferin sync.

In step 206, the linecard searches the MAP message data pertinent to thedesignated upstream or logical channel and determines the minislotnumbers of the upstream bursts to be captured. The UCD data pertinent tothe upstream or logical channel on which a burst is to be captured isalso searched and the burst parameter data of each burst to be capturedis retrieved and used to generate suitable control signals to thesniffer burst capture circuitry to set it up to capture the burst.

The linecard then monitors the local timestamp counter in step 208, andwhen the minislot number which is the first minislot at the beginning ofa burst to be captured occurs at the linecard upstream tap, the linecardcircuitry to capture the designated burst is turned on.

The captured burst is then sent to the CPU 34 of the linecard fortransfer to the computer 37 for display and/or analysis, as symbolizedby step 210.

FIGS. 11A through 11C illustrate the process the DOCSIS 2.0 upstream anddownstream sniffers of FIGS. 1 and 2 go through to establishsynchronization with a designated downstream and a designated upstreamand capture downstream bursts and upstream DOCSIS 1.x bursts andupstream DOCSIS 2.0 advanced TDMA bursts. In step 212, the sniffer ofFIG. 1 or FIG. 2 receives a command from computer 37 indicating whichDOCSIS 1.x downstream to which to lock. The cable modem in the snifferthen recovers the downstream symbol clock of the designated downstream,and uses the recovered clock to recover downstream bursts and messagesin step 214. In step 216, the sniffer receives commands from computer 37that indicate which upstream or upstream logical channel linked to thedownstream designated in step 212 to which to synchronize and whichbursts on that upstream or logical channel (by SID, IP address, minislotnumber etc.) are to be captured.

In step 218, the CM in the sniffer captures downstream UCD and MAPmessages for all the upstreams linked to the downstream designated instep 212 or at least for the upstream or logical channels upon which theupstream bursts designated in step 216 will be transmitted. In step 220,the CM in the sniffer captures sync messages of the designateddownstream for all linked upstreams or at least for the upstream orlogical channel(s) designated in step 216. These captured sync messages,or at least the data therefrom, are passed on to the linecard CPU 34 instep 220.

In step 222, the linecard generates a free running 10.24 MHz clocksignal using a PLL. In step 224, the linecard sets the initial value ofa timestamp counter in the sniffer to the timestamp sample value in thefirst sync message captured by the CM in the sniffer in the downstreamafter powerup or after receiving the message indicating what downstreamto lock to and locking to that downstream. In step 226, the linecardreceives subsequent sync messages from the CM in the sniffer. Thetimestamp samples in these subsequent sync messages are compared to thetimestamp count of the local timestamp counter. If there is adifference, the new timestamp value is loaded into the timestamp counterin the CMTS 32 or wherever the timestamp counter in the timebase of thesniffer is located. In the CMs of the sniffer and the CMs under test,the new timestamp value difference is used to generate an error signalthat is used to adjust the frequency of the local 10.24 MHz clock in adirection to reduce the difference in the timestamp counts between thelocal timestamp counter and the master timestamp counter in the CMTS.

In step 228, an initial station maintenance burst from the CM under testis received by the linecard, and the CMTS in the sniffer makes time,phase, frequency and power offset measurements using the known symbolsof the preamble. The CMTS in the sniffer also uses the preamble of thetraining burst to adaptively develop upstream equalization filtercoefficients. The CMTS in the sniffer then sends all these offsetmeasurements and equalization filter coefficients to the CPU 34 on thelinecard.

Next, in step 230, the CM in the sniffer captures the ranging responsemessage sent by the CMTS 10 under test to the CM under test that sentthe training burst. This ranging response message contains the time,phase, frequency and power offset measurements made by the CMTS undertest on the same training burst that was processed by the sniffer CMTSin step 228. The captured ranging response message is sent to the CPU onthe linecard.

In step 232, the linecard CPU takes the time offset measurement from theCMTS in the linecard and subtracts the time offset measurement made bythe CMTS under test, and sends a command to the variable delay circuitin the FPGA on the linecard to establish a proper delay to implement thedifference. The difference is also used to advance the timestamp countercount by an amount sufficient to achieve upstream minislot boundarysynchronization between the sniffer and the CMs under test.

In step 234, the linecard CPU uses the rest of the ranging measurementsdeveloped by the CMTS in the sniffer and the ranging measurementsdeveloped by the CMTS under test and generates suitable commands basedupon the differences to control circuitry in the RF demodulator to makeappropriate phase, power and frequency adjustments and to set the filtercoefficients of the equalization filter in the FPGA to achieve properupstream equalization for the position of the sniffer on the HFCupstream medium relative to the CMTS under test. This completessynchronization to the upstream or logical channel designated in step216.

In step 236, the linecard searches the MAP data pertinent to thedesignated upstream and determines the minislot numbers of thedesignated upstream bursts to be captured. The UCD data pertinent to theupstream or logical channel on which a burst is to be captured is alsosearched and the burst parameter data of each burst to be captured isretrieved and used to generate suitable control signals to the snifferburst capture circuitry to set it up to capture the burst.

In step 238, the linecard monitors the count of the linecard minislotcounter, and when the beginning minislot number of a burst to becaptured occurs on the linecard minislot counter (or just before itoccurs), suitable commands are generated by CPU 34 to turn on the burstcapture circuitry of the sniffer and capture the burst.

In step 240, the CMTS receiver in the sniffer recovers the upstreamsymbol clock used by the CM under test that transmitted the burst thatwas captured. The symbol clock is recovered from the preamble of thecaptured burst, and is used to synchronize a local upstream symbol clockwhich is used to recover the data in the data portion of the burst.

Finally, in step 242, the captured burst data is sent to the CPU 34 fortransfer to the computer 37 for display and/or analysis.

Sniffer Interfaces

The sniffer interfaces for the embodiments of FIGS. 1 and 3 are theupstream RF interface to the upstream medium of the HFC system, thedownstream RF interface to the downstream medium of the HFC system, a20.48 MHz reference clock input to couple to a CMTS under test, a 10.24MHz clock interface to the CMTS under test, and a 10/100 BaseT Ethernetinterface to the personal computer 37.

Alternative Sniffer Embodiments Using Only a Cable Modem

FIGS. 4, 5 and 6 are block diagrams of sniffers which use only a cablemodem to capture upstream bursts from any of the other cable modems inthe system. Since the cable modem in these alternative embodimentssniffers receive the downstream MAP messages, it knows the assignedminislots for all the other cable modems in the system. Since it islocked onto the same downstream as all the other cable modems in thesystem, it also has its upstream timestamp counter synchronized usingthe same timestamp samples from the sync messages and timestampsnapshots in DOCSIS 2.0 downstreams as all the other cable modems in thesystem. Since every cable modem in the system uses the same free runningupstream clock frequency and the same sync messages to keep their localupstream timestamp counters in synchronization with the master upstreamtimestamp counter in the CMTS, each cable modem in the system will beusing the same timestamp counts to determine the boundaries of theupstream minislots at the location of that cable modem. Thus, the cablemodem in the sniffer can be used advantageously to control a separatetuner and buffer in the sniffer to capture every upstream burst in thesystem.

Referring to FIG. 4, the sniffer 84 has a cable modem 96 which iscoupled to both the downstream medium and the upstream medium of HFCsystem 86 (separate DS and US mediums not shown). To be able to capturethe upstream bursts from all other cable modems on the system using thesniffer of FIG. 4, it must be connected to the HFC system 86 at a pointcloser to the CMTS 88 than all the other cable modems on the system. Theother cable modems on the system are shown at 90, 92 and 94. If it isnot so coupled, it will only be able to intercept and capture theupstream bursts of the other cable modems on the HFC system farther awayfrom the CMTS than the sniffer.

The cable modem 96 is coupled to the downstream from the CMTS 88 via adiplexer 100, a programmable tuner 102, and a programmable gainamplifier 104. All these circuits are conventional and are controlled bythe modem 96 via control signals on bus 106 to tune the correctdownstream channel after initially searching for and locking onto anylegitimate DOCSIS downstream channel at power up and registering as acable modem in the system. The CMTS will then send a message to thecable modem telling it what downstream channel to which it should tune.The cable modem 96 is also coupled to the upstream by a conventional DQU(digital quadrature up converter) 108 which receives constellationpoints of upstream bursts in digital format and modulates them ontoquadrature upstream carriers and transmits them on the upstream mediumthrough diplexer 100. Diplexer 100 controls the direction oftransmission of the upstream and downstream signals so that downstreamsignals enter tuner 102 and signals received from programmable gainamplifier 110 enter the upstream medium of HFC system 86.

A programmable gain amplifier 110 amplifies the upstream RF signalsgenerated by CM 96 in accordance with gain control signals received fromthe cable modem on bus 112. The cable modem 96 controls the frequency ofthe upstream carriers via signals on bus 112 to the DQU 108 fortransmissions to the CMTS 88. The cable modem 96 controls the frequencyand gain levels of its transmitted signals in accordance with downstreaminstructions from the CMTS 88 just like any conventional DOCSIS 2.0cable modem.

Because the sniffer is a cable modem which is tuned to the CMTSdownstream, it registers with CMTS 88 as a regular cable modem, and itreceives all the downstream messages including the MAP, UCD, sync,ranging-request and ranging response messages. Because it has theregular DOCSIS 2.0 cable modem functionality, it will respond to rangingresponse messages by sending training bursts and will receive rangingresponse messages which include timing offset, power offset, phaseoffset and frequency offset correction measurements made by the CMTS 88on the training burst sent by the sniffer 84. It will also receiveupstream equalization coefficients developed by the CMTS 88 from thetraining burst sent upstream by the cable modem 96 in the sniffer. Thecable modem 96 also recovers the downstream symbol clock and generates aDOCSIS 2.0 upstream clock for use in sending upstream 2.0 SCDMA burstsand forwarding them to the CMTS under test in some embodiments. For TDMAbursts, the sniffer's cable modem uses a free running symbol clockcounted by an upstream timestamp counter which is corrected inaccordance with the process of FIG. 3 using the downstream timestampmessages whenever deviations from a synchronized state occurs. Whensniffer 96 makes all the requested corrections in the ranging responsemessage and has its local timestamp counter in sync with the CMTS masterupstream timestamp counter, it will be completely synchronized to theCMTS 88 and will be synchronized with all the other cable modems in thesystem and will be able to determine when each upstream minislot isoccurring at its tap point 98 on the HFC system.

Because sniffer 84 receives the MAP messages in the downstream, it knowswhat the upstream assigned minislots are for every other CM in thesystem. To capture the upstream bursts from the other CMs in the system,the cable modem 96 sends control signals on the bus 112 to a separateline of circuits called the burst capture circuitry in the claims whichfunctions to capture the upstream bursts. This line of circuitryincludes a tuner 114 which the cable modem controls by signals on bus112 to turn on during the duration of the burst and to set the frequencyof a local oscillator (not shown) in tuner 114 to tune to the upstreamcarrier frequency of the burst to be captured. Typical structures forthe tuner are shown in the patent application which is incorporated byreference herein and which is published in Europe and covers the JasperCMTS receiver (Docket Number TER-013, EPO Publication number 1235402).Typical tuner structure for circuit 114 includes a mixer and localoscillator to mix the center frequency of the desired channel with theburst to be captured down to some intermediate frequency of a passbandfilter such as a SAW filter. The SAW filter or other filter is then usedto filter out undesired RF signals on the high and low side of the bandof frequency components in the Fourier spectrum of the burst to becaptured. In some embodiments, an analog passband filter withprogrammable filter coefficients which can be altered to adjust thebandwidth of the passband of the filter is used to do this filtering. InDOCSIS 1.0, 1.1 and 2.0 bursts, the symbol rate is programmable so thebandwidth of the burst depends upon the symbol rate. This means a filterwith a programmable bandwidth can be used to filter out unwanted RFsignals outside the bandwidth of interest. However, this is difficult todo in the analog domain and the signals of the burst to be captured arestill analog inside tuner 114. Therefore, in the preferred embodiment, aSAW filter with a fixed bandwidth passband which is set wide enough toencompass the bandwidth of a DOCSIS burst having the highest possiblesymbol rate is used to filter out most unwanted RF signals inside tuner114. Then, in an optional alternative embodiment (as indicated by thedashed lines around filter 123), a digital passband filter 123 is used.This programmable digital filter is coupled to receive the digitalsamples output by an analog-to-digital converter 118. The digital filter123 has programmable filter coefficients which are set by the cablemodem 96 by signals on bus 112 to establish the passband of the filter123 according to its symbol rate so as to filter out the unwanted RFcomponents outside the actual bandwidth of the burst to be captured. Thecable modem 96 knows the symbol rate of every burst to be captured fromthe burst profile data in the UCD messages it receives from the CMTS 88in the DOCSIS downstream. There is one UCD message for every channel.Data in these UCD messages define the burst and channel characteristicsfor every burst the corresponding channel.

A programmable gain amplifier 116 is controlled by signals on bus 112from cable modem 96 to turn on during the duration of the burst to becaptured and its gain is controlled to amplify the received signal tothe proper level to use the full dynamic range of an A/D converter 118.The A/D converter is enabled by a signal on bus 112 during the burst tobe acquired. Finally, a buffer 120 captures the digital samples whichdefine the captured burst. The cable modem 96 controls the buffer viaenable signals on bus 112 to enable the buffer to store the samples ofthe burst when the burst arrives.

The cable modem 96 uses the data in the downstream MAP messages to knowwhen each cable modem will transmit and uses its local timestamp countercounts to know when those assigned upstream minislots are occurring atthe upstream sniffer tap 122. The upstream sniffer tap 122 couples theupstream medium of the HFC system 86 to the RF input of the sniffertuner 114. The cable modem 96 uses information in the UCD message toknow the frequency, symbol rate and other burst parameters of the burstto be captured. The cable modem 96 then suitably controls the tuner 114and the programmable gain amplifier 116 and the A/D converter 118 andthe programmable digital filter 123 (if used) and the buffer 120 tocapture the samples of each burst in buffer 120. The burst is notactually removed from the upstream medium by the sniffer. It continuesto the CMTS so as to not cause the CMTS protocols to be adverselyaffected.

Once the sample data in the burst is captured, it may be processed inany way desired.

In some embodiments, the sniffer 84 captures every burst. In otherembodiments (as indicated by dashed lines in FIG. 4 to PC 124), thesniffer 84 is controlled by a user interface implemented on a personalcomputer 124 so as to only capture selected bursts such as all burstsfrom a particular CM or all bursts of a specified type. The PC 124 iscoupled to the cable modem typically by a 100 BaseT LAN link 126.However, in alternative embodiments, the connection to the PC 124 may beby any known interface such as USB, SCSI, Firewire, Fibre Channel, 100BaseT, token ring, etc. or by a proprietary interface.

Referring to FIG. 7, there is shown a flowchart of the process carriedout by the sniffer of FIG. 4 to lock onto a DOCSIS downstream, registeras a cable modem, get into synchronization with the CMTS and startcapturing upstream bursts. Step 128 represents the process of thesniffer of FIG. 4 searching for any legitimate DOCSIS downstream andlocking onto it. This step is performed conventionally in the manner anyDOCSIS 2.0 cable modem performs this process. Step 130 represents theprocess of the cable modem in the sniffer of FIG. 4 registering with theCMTS as a DOCSIS 2.0 cable modem. The CMTS may order the cable modem toswitch to another downstream after the cable modem in the sniffer hasregistered with the CMTS, and, if this occurs, the cable modem will tuneto this requested downstream, lock onto it and may re-register using theupstream associated with the new downstream. This process, although notspecifically mentioned in steps 128 and 130, is also symbolized by steps128 and 130.

Step 132 represents the process of receiving a downstream DOCSIS rangingrequest message that defines a ranging contention interval during whichcable modems which have not performed their initial training may do so.In step 134, the cable modem in the sniffer performs an initial rangingoffset determination and sets its ranging offset, and then transmits aninitial training burst using this initial ranging offset in an attemptto hit the ranging contention interval. If the training burst hits theranging contention interval and does not collide with another trainingburst, the CMTS processes the training burst to determine a rangingoffset, frequency and amplitude offsets, a phase offset and calculatesupstream equalization coefficients from the known preamble data. Thedata portion of the training burst tells the CMTS which cable modem sentthe training burst. The ranging offset is a measurement of how far offthe desired time of arrival at the CMTS the training burst arrived (itis supposed to arrive at the beginning of the ranging contentioninterval). The frequency offset is a measurement of how far off thefrequency of the training burst is from the desired frequency of theupstream channel which this cable modem transmitted upon. The amplitudeoffset is a measurement of how much the CM must adjust its transmitpower to cause its burst to arrive at the CMTS at nominal or desiredpower. The phase offset is a measurement of how far off the desiredphase the training burst was. The equalization coefficients arecoefficients developed by an adaptive equalization process which whenset into an upstream equalization filter in the CMTS equalizes theupstream channel on which the training burst was sent to remove theintersymbol interference effects of echoes and dispersion (differentpropagation speeds of different frequencies) of the Fourier frequencycomponents of the transmitted signal. The CMTS then sends these offsetcorrections and equalization coefficients down to the cable modem in thesniffer, which receives them in step 136. The cable modem then makes therequested ranging offset adjustments, adjusts it frequency and transmitpower, adjusts its phase and convolves the equalization coefficientswith the coefficients of the precode filter in the upstream transmitterof the sniffer which were in use when the training burst was sent.

Step 138 represents the process of receiving downstream synchronizationmessages and using the timestamps therein to make any necessaryadjustments in the localt timestamp counter in the cable modem in thesniffer. This is done by the process of FIG. 2 typically, and results inthe local timestamp counter being in synchronization with a masterupstream timestamp counter in the CMTS used by the CMTS to determine theboundaries of upstream minislots assigned to various CMs for upstreamtransmissions. The state of synchronization means that the localtimestamp counter will be counting at a virtually identical rate andthere will be a fixed offset caused by propagation delays, and wheneverthe offset gets out of sync, a correction will be made in the localtimestamp count using the timestamp sample from a sync message ortimestamp snapshot message.

Step 140 represents the process of receiving the downstream UCD and MAPmessages and storing them. The UCD messages define the burst parameterssuch as frequency and symbol rate and modulation type for every upstreamburst and its logical channel. The MAP messages are bandwidth grantswhich define the minislots during which each cable modem may transmitupstream.

Step 142 represents the optional process of receiving input commandsindicating which bursts to capture or other data indicating exactlywhich IP addresses or Service Identifiers (SIDs) or upstream minislotnumbers to sniff. In some embodiments, all upstream bursts will becaptured, but in others, data will be received from an external controlprocess such as a control process running on a personal computer coupledto the sniffer by a Ethernet connection controlling the sniffer tocapture only selected bursts. In some embodiments, the sniffer listensto registration traffic and learns the SIDs of each cable modem in thesystem.

Step 144 represents the process of reading the UCD and MAP messages todetermine when the bursts to be captured are going to be arriving at thesniffer (to determine the upstream minislots assigned to the bursts tobe captured), and to determine the burst parameters such as thefrequency of the logical channel on which the burst will be transmittedand its symbol rate.

Finally, in step 146, the sniffer determines from its local timestampcount when the burst to be captured will be arriving at the sniffer andgenerates suitably timed control signals on bus 112 to control the burstcapture circuitry to capture the burst. Specifically, the tuner will beenabled and ordered to tune the proper frequency, and the symbol ratewill be used to set the coefficients of the passband filter to set theproper passband (assuming a programmable digital passband filter isused), and the amplifier will be enabled and its gain set and the bufferwill be enabled and addresses to store the digital samples will begenerated. These addresses may be generated in any way and may not begenerated by the cable modem in all embodiments.

In alternative embodiments, bursts from all SIDs will be captured. Inother alternative embodiments, any process will suffice to practice theinvention which: performs upstream training and registers with the CMTSand achieves upstream minislot boundary synchronization with the CMTSthrough normal DOCSIS protocols; receives data defining which bursts tocapture or to capture specified or all upstream transmissions fromspecified SIDs or IP addresses; listens to registration traffic to learnthe SID of each CM in the system; receives UCD and MAP messages and hasthe capability to search the MAP messages to find the correspondingminislot numbers of authorized upstream bursts from specific SIDs; andwhich can use the local timestamp counter to generate properly timedcontrol signals for the sniffer burst capture circuitry to capture thedesignated bursts. One way to generate the proper timing is for thesniffer to fake a MAP that authorizes a transmission during theminislots that map to the burst to be captured and then not actuallytransmit any upstream data but use signals generated in the transmitterto generate the appropriate timing to generate the control signalsnecessary to control the burst capture circuitry. In some embodiments,the tuner and programmable gain amplifier can be left on all the timeand only the A/D converter and address generation for the buffer isenabled during the upstream minislots corresponding to a burst to becaptured.

The embodiments of FIGS. 5 and 6 are sniffer/repeaters. The maindifference between these embodiment and the embodiment of FIG. 4 is thatin the embodiments of FIGS. 5 and 6, the original upstream burst fromthe cable modem under test does not get to the CMTS via the upstreammedium 152 of the HFC system 86. Instead, all upstream bursts getcaptured in buffer 120 and then repeated to the CMTS 88 a fixed timedelay later via path 150. In other words, every upstream burst onupstream medium 152 is received by tuner 114, amplified by amplifier 116to maximize the use of the dynamic range of the A/D converter 118,filtered by the programmable digital filter 123 (if used) and stored inbuffer 120. A fixed time delay later, the samples of each burst areconverted back into an RF signal of the same frequency they originallywere and are transmitted to the CMTS on upstream medium 150. In themeantime, the samples of each burst in buffer 120 may be processed ormoved to other storage (not shown).

In the embodiment of FIG. 6, all upstream bursts are diverted bydiplexer 101 to tuner 114 and are captured in buffer 120. After a fixeddelay, the samples of each burst are converted back to RF andtransmitted to the CMTS 88 on path 150.

In these embodiments, an additional step is added to the end of FIG. 7to control the sniffer repeater circuitry (not separately shown) toconvert the samples of each burst back into an RF signal of the samefrequency of the original burst and re-transmit them on upstream medium150.

In these embodiments of FIGS. 5 and 6, if a conventional CMTS 88 withburst acquisition circuitry is used, the buffer circuit 120 includescircuitry such as a digital-to-analog converter and digital quadratureup converter (DQU) to convert the samples of the IF signal digitized byA/D converter 118 back into IF signals and then up convert the analog IFsignals back to the original radio frequency signals received by tuner114 which the CMTS will reacquire. These optional circuits are shown indashed lines as circuits following or part of buffer 120 in FIG. 5 andare present in embodiments like FIG. 6 also which use conventional CMTSreceivers 88 although they are not shown in the drawing. The CMTSprotocols do not get derailed by this process as long as there is afixed delay between the time the burst is captured and the time it isrepeated. This delay just causes the CMTS to think that the CM that senteach burst is further away from the CMTS than it really is.

In the embodiment of FIG. 5, the upstream medium 152 is disconnectedfrom the CMTS 88 and is connected only to the tuner 114 in the sniffer.In the embodiment of FIG. 6, a diplexer 101 separates the upstreamsignals on HFC 86 and supplies them on path 103 to tuner 114. Downstreamsignals from the CMTS enter the diplexer 101 on path 105 and are coupledonto the downstream medium of the HFC system 86. Diplexer 100 couplesthe upstream path 107 and the downstream path 109 of the cable modem 96onto the appropriate medium of the HFC system 86. If separate medium forupstream and downstream are not used at the point of the tap 98, thenthe diplexer uses the different frequencies of the upstream anddownstream transmission bands to separate the upstream and downstreamtraffic and couple each for transmission in the proper direction, andthe same is true of diplexer 101.

All other software in the cable modem in the sniffer is conventional.

One important class of embodiments for the sniffers of FIGS. 5 and 6 isfor the buffer 120 to not include any circuitry that converts thedigital samples of the captured bursts back to analog signals. In thisclass of embodiments, the CMTS 88 pushes the burst acquisition functionout to the optical nodes. In other words, in these embodiments, thenormal burst acquisition circuitry in the CMTS 88 (which is a duplicateof the tuner 114, programmable gain amplifier 116, A/D converter 118,programmable filter 123 and buffer 120) is eliminated. This is becauseits functionality is pushed out to the location of the optical node, sothe CMTS only needs the signal processing circuitry that processes thefiltered digital samples of each burst. This allows a more efficient useof the CMTS receiver by placing a sniffer at the location of eachoptical node (or at the CMTS in some embodiments) to capture allupstream bursts as digital samples and send only the digital samples ofthe captured bursts to the CMTS 88. The CMTS 88 in these embodimentswould contain only the signal processing circuitry of a conventionalCMTS which is normally located after the burst acquisition circuitrywhich tunes, filters, digitizes, decimates, and buffers each burst. Thisarrangement with a sniffer at each optical node would replace thedigital return structure of the prior art shown in FIG. 8 with thesniffer based structure of FIG. 9.

The embodiment of FIG. 8 samples all minislots of the upstream on line154 output by the diplexer 156 at the optical node using an A/Dconverter 158 which samples the amplified output from amplifier 160 at ahigh sample rate. All minislots, including empty ones, are sampled byA/D converter 158 and output to a framer 162. The framer outputs bits toa digital laser diode 164 which converts them to light pulses which arecarried by optical fiber 166 to a photodetector diode 168 at the headend. A buffer 170 stores the samples, and a diplexer 172 separate theupstream from the downstream and couples the signals from the buffer 170to a CMTS 174 for the upstream and couples downstream signals from theCMTS 174 to a downstream 176.

FIG. 9 is a block diagram of a sniffer based digital return structurefrom the diplexer at the optical node to the CMTS which captures onlythe bursts and does not sample empty minislots like the structure inFIG. 8. Only the actual bursts on the upstream line 154 from thediplexer 156 are captured in sniffer 178 and empty minislots areignored. The bursts include the protocol messages so no protocol upsetsoccur. The sniffer has the structure of either FIG. 5 or FIG. 6. Thedigital samples of each burst are output from the sniffer 178 to aframer 162 and converted to light pulses by a laser diode 174. Fromthere all the rest of the circuitry is the same. The CMTS 174 does notneed any burst acquisition circuitry because that functionality isperformed out at the optical nodes.

The advantage of the system of FIG. 9 is that only the bursts arecaptured and sampled and everything else is ignored. This means thatmultiple optical nodes can be daisy chained together for maximizing theefficiency of use of the optical fiber 166 and the CMTS 174. The CMTS174 can be only signal processing circuitry and needs no burstacquisition circuitry (the same is true of FIG. 8 prior art). However,in FIG. 9, the CMTS is used more efficiently than in FIG. 8 prior artbecause the pipelined stages of CMTS 174 are kept filled with burst dataat all times and no pipeline stage is processing samples of emptyminislots at any time.

Timebase Search Mode

The linecard CMTS receiver 32 can adjust its timebase using the initialIUC3 training burst of the CM under test if the CM under test 18 has notyet performed initial training. However, if the sniffer is coupled tothe upstream medium 14 after the CM under test 18 has performed itsinitial training, the linecard 26 may be unable to receive the IUC4periodic station maintenance bursts because its timestamp counter may betoo far off to know where the IUC4 window beginning minislot is in time.

To resolve this problem, the operator may elect to reset one of the CMsunder test to force the CM to transmit an IUC3 initial stationmaintenance training burst which will enable the linecard 26 in thesniffer to bet in synchronization.

If the CM under test is not reset, and the linecard is unable to detectan IUC4 periodic station maintenance burst, then the linecard will gointo an automatic timebase search mode. In this mode, the linecardchanges its timestamp counter setting in a trial and error manner andtries after every iteration to receive and IUC4 periodic stationmaintenance burst from the CM under test. If an IUC4 burst issuccessfully received, the timestamp counter can be adjusted properlyusing the clock offset corrections generated by the CMTS 10 under testfrom the IUC4 burst. If an IUC4 burst is not received, the operator isnotified and must force a reset of the CM 18 under test.

The only modifications that need to be made to the sniffer cable modemand CMTS software in this second genus of sniffers is to use the MAP andUCD data to generate suitable control signals to control the burstcapture circuitry to capture upstream bursts at the proper times. Insome embodiment, modifications must also be made to receive user inputdefining which bursts to capture. In other embodiments, no suchmedication to receive user input need be made since the sniffer capturesall upstream bursts.

Although the invention has been disclosed in terms of the preferred andalternative embodiments disclosed herein, those skilled in the art willappreciate possible alternative embodiments and other modifications tothe teachings disclosed herein which do not depart from the spirit andscope of the invention. All such alternative embodiments and othermodifications are intended to be included within the scope of the claimsappended hereto.

1. A sniffer capable of capturing DOCSIS bursts transmitted between oneor more cable modems (CMs) under test and a cable modem terminationsystem (CMTS) under test via a hybrid fiber coaxial cable system,comprising: a sniffer upstream receiver capable of receiving DOCSISupstream bursts; a sniffer cable modem coupled a hybrid fiber coaxialcable (HFC) system by an analog signal path capable of receivingdownstream DOCSIS data bursts and messages transmitted by said CMTS; aself ranging circuit coupling said HFC cable system to said snifferupstream receiver, comprising: an RF demodulator means for amplifying,filtering and digitizing received radio frequency signals carryingupstream DOCSIS bursts; a delay and upstream equalization filtercircuit; a sniffer clock generator for generating a reference clocksignal for said sniffer upstream receiver; and a computer coupled tosaid sniffer cable modem, said sniffer upstream receiver, and said selfranging circuit, for controlling said sniffer cable modem, said snifferupstream receiver and said self ranging circuit and for receiving datafrom downstream DOCSIS bursts captured by said sniffer cable modem andfor receiving data from upstream DOCSIS bursts captured by said snifferupstream receiver.
 2. The apparatus of claim 1 wherein said sniffercable modem is structured and programmed to receive and send to saidcomputer only downstream DOCSIS messages, and further comprising asecond sniffer cable modem which is coupled to said computer and whichis structured and programmed to receive downstream DOCSIS data burstsand transmit data therefrom to said computer.
 3. The apparatus of claim1 wherein said sniffer upstream receiver is capable of receiving DOCSIS2.0 synchronous code division multiplexed upstream bursts.
 4. A sniffercapable of capturing DOCSIS 1.0, DOCSIS 1.1 and DOCSIS 2.0 burststransmitted by one or more cable modems (CMs) under test to a cablemodem termination system (CMTS) under test via a hybrid fiber coaxialcable system (HFC), comprising: a port at which commands are receivedindicating which DOCSIS 1.0, 1.1 and 2.0 upstream and downstream burststo capture; a linecard circuit coupled to said port for capturing thedesignated upstream bursts and outputting them at said port; a cablemodem coupled to said HFC and to linecard circuit for recovering adownstream symbol clock and recovering said designated downstream burstsand sending said captured downstream bursts to said linecard for outputat said port, and for generating a reference clock signal which is phasecoherent with said recovered downstream symbol clock when said snifferis assigned to capture an upstream DOCSIS 2.0 synchronous code divisionmultiplexed burst; and a clock generator for receiving said referenceclock signal and generating an upstream clock reference for saidlinecard circuit which is phase coherent with said reference clocksignal when said sniffer is assigned to capture an upstream DOCSIS 2.0synchronous code division multiplexed burst.
 5. The apparatus of claim 4wherein said linecard circuit includes a computer programmed to receivedownstream messages captured by said cable modem and use the contentthereof along with measurements and filter coefficients derived by saidlinecard circuit from captured upstream station maintenance bursts togenerate suitable control signals to keep said linecard in synchronismwith upstream bursts transmitted by any cable modem under test so as tobe able to capture said upstream bursts if said bursts have beendesignated for capture.
 6. A process to capture upstream DOCSIS 2.0bursts in a sniffer, comprising: (1) recovering a downstream symbolclock and using it to capture downstream messages transmitted from acable modem termination system under test, and, if DOCSIS 2.0synchronous code division multiplexed bursts are to be captured,generating a local upstream reference clock from said recovereddownstream symbol clock which is locked to a master clock in said cablemodem termination system under test or at least phase coherent with saidrecovered downstream symbol clock; (2) using said local upstreamreference clock to synchronize a timebase including a local upstreamminislot counter in a sniffer to an upstream channel upon which upstreambursts to be captured will be transmitted; (3) performing a self rangingprocess using captured upstream initial and periodic station maintenancebursts and captured downstream ranging response message data to get atimebase into synchronization with an upstream on which bursts to becaptured will be transmitted; (4) using said upstream minislot counterand data in captured downstream messages to capture upstream bursts,possibly including DOCSIS 2.0 synchronous code division multiplexedbursts from a cable modem under test.
 7. The process of claim 6 whereindownstream bursts are captured using first and second DOCSIS 2.0compatible cable modems in a sniffer which have been modified to capturebursts and messages directed to other cable modems, and using said firstcable modem to capture only downstream data bursts and using said secondcable modem to capture only downstream messages.
 8. The process of claim6 wherein the step of recovering a downstream symbol clock andgenerating said local upstream reference clock from said recovereddownstream symbol clock which is locked to a master clock in a cablemodem termination system under test is performed by recovering saiddownstream symbol clock and using said recovered downstream symbol clockas a reference signal for a phase lock loop which generates said localclock and removes phase noise from said recovered downstream symbolclock.
 9. An sniffer capable of capturing upstream DOCSIS 1.0, 1.1 and2.0 bursts comprising: burst capture circuitry coupled to a hybrid fibercoaxial cable (HFC) system upstream medium which couples a plurality ofcable modems (CM) under test to a cable modem termination system (CMTS)under test for exchange of DOCSIS 1.0, 1.1 and 2.0 bursts therebetween;and a cable modem coupled to said DOCSIS compatible cable systemupstream and downstream mediums and coupled to said burst capturecircuitry, and functioning to register with a cable modem terminationsystem (CMTS) under test as another cable modem in the system, recover adownstream symbol clock and use it to capture downstream messagestransmitted by said CMTS under test and extract data therefrom needed totime and control said burst capture circuitry to capture upstream DOCSIS1.0, 1.1 and 2.0 bursts transmitted from cable modems under test. 10.The apparatus of claim 9 further comprising means to divert upstreambursts from said CMs under test away from said CMTS and into said burstcapture circuitry, and means for transmitting each captured burst storedin said burst capture circuitry to said CMTS a fixed time later aftercapture of said burst.